Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-81721: openssl_encrypt can run out of memory and stop
CVE-2026-81721 · published 2 months ago
Summary
The openssl_encrypt library (versions before 1.4.9) does not check how large the memory‑intensive settings are in encrypted files. An attacker could provide a specially crafted file that forces the program to allocate an extreme amount of memory, causing it to run out of memory and halt. Upgrade to version 1.4.9 or later, or apply the vendor’s patch, and avoid processing encrypted files from untrusted sources.
What to do
- Update jahlives openssl_encrypt to version 1.4.9 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
Original advisory text
openssl_encrypt before 1.4.9 Denial of Service via KDF
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7894-5gw8-6... Vendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-denial-of-serv... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81721... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-81721 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published27 Aug 2026
Updated4 Nov 2026
First seen27 Aug 2026
Track software like this
Free during beta